Skip to content

Instantly share code, notes, and snippets.

@fnpial
fnpial / 1_top+hacker_methodologies.md
Created January 7, 2024 18:37 — forked from ruevaughn/1_top+hacker_methodologies.md
Hacker Methodologies & Tools (NEW)

The Top Hacker Methodologies & Tools Notes

Nuclei Templates

Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting


@fnpial
fnpial / index.md
Created December 10, 2023 06:44 — forked from paj28/index.md

Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.

Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/

A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping: